Bump docker/login-action from 4.2.0 to 4.4.0

[dependabot]

Bumps docker/login-action from 4.2.0 to 4.4.0.

Release notes

Sourced from docker/login-action's releases.

v4.4.0

• Skip empty registry-auth secret mask by @​crazy-max in docker/login-action#1035
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1077.0 docker/login-action#1034

Full Changelog: docker/login-action@v4.3.0...v4.4.0

v4.3.0

• Preserve names in esbuild bundle by @​crazy-max in docker/login-action#1022
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1076.0 docker/login-action#999 docker/login-action#1030
• Bump @​docker/actions-toolkit from 0.90.0 to 0.92.0 in docker/login-action#1004 docker/login-action#1027
• Bump @​sigstore/core from 3.1.0 to 3.2.1 in docker/login-action#1023
• Bump @​sigstore/verify from 3.1.0 to 3.1.1 in docker/login-action#1029
• Bump http-proxy-agent and https-proxy-agent to 9.1.0 in docker/login-action#1017
• Bump js-yaml from 4.1.1 to 5.2.0 in docker/login-action#1028
• Bump sigstore from 4.1.0 to 4.1.1 in docker/login-action#1031
• Bump tmp from 0.2.5 to 0.2.7 in docker/login-action#1002
• Bump undici from 6.24.1 to 6.27.0 in docker/login-action#1020
• Bump vite from 7.3.3 to 7.3.6 in docker/login-action#1019

Full Changelog: docker/login-action@v4.2.0...v4.3.0

Commits

• af1e73f Merge pull request #1034 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
• da722bd [dependabot skip] chore: update generated content
• 2916ad6 build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
• ca0a662 Merge pull request #1035 from crazy-max/fix-registry-auth-empty-mask
• c455755 chore: update generated content
• 4835190 skip empty registry-auth secret mask
• 992421c Merge pull request #1033 from docker/dependabot/github_actions/docker/bake-ac...
• b249b43 Merge pull request #1032 from docker/dependabot/github_actions/docker/bake-ac...
• 1b67977 build(deps): bump docker/bake-action from 7.2.0 to 7.3.0
• 9d49d6a build(deps): bump docker/bake-action/subaction/matrix
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
Single CI dependency bump with no application or credential-handling logic changes in this repo.

Overview
Updates the Deploy Review App workflow’s GHCR login step to use docker/login-action@v4.4.0 instead of v4.2.0. Registry, username, and token inputs are unchanged; only the action version in .github/workflows/deploy-review.yml changes.

^{Reviewed by Cursor Bugbot for commit de5eb0f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

I'll review the upstream docker/login-action 4.2.0→4.4.0 changes against the malware checklist, starting with the meaningful source/diff and scanner findings.Next I'll verify consumer-side usage and classify the scanner heuristics so we don't over-weight noise in the bundled dist.Verdict: benign

Minor bump 4.2.0 → 4.4.0 of the official Docker-maintained GitHub Action. Tags/releases match; no install/lifecycle scripts; no invisible Unicode/IOC findings.

Evidence

• Meaningful source delta is a small hardening change: skip core.setSecret() when registry-auth password is empty (src/context.ts + tests), plus --keep-names in the esbuild build.
• Remaining changes are expected dep bumps (@aws-sdk/*, @docker/actions-toolkit, proxy agents, js-yaml, etc.) and regenerated dist/.
• Upstream .github/workflows/* edits are this action’s own CI/docs maintenance, not payloads delivered to consumers via the action pin.
• Scanner status warn with 0 unicode / confusable / IOC hits. The 167 heuristics are false positives on the minified bundle (charCodeAt in undici/yaml/AWS SDK), lockfile/@actions/exec name matches, README token docs, and a generic maintainer_drift on the version bump—not indicators of compromise.

Compatibility Analysis

I'll analyze local usage of docker/login-action and compare it against the upstream 4.2.0→4.4.0 changes.## Compatibility verdict: merge

1) Local usage

Single site: .github/workflows/deploy-review.yml — GHCR login for review image push:

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v4.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

No other workflows use this action. Inputs used: registry, username, password only. No ecr, registry-auth, scope, or logout overrides.

2) Intersection with changed APIs

None for this repo’s usage.

action.yml inputs/outputs are unchanged from v4.2.0 → v4.4.0. The only app-source change is in src/context.ts: skip core.setSecret when registry-auth password is empty. Everything else is dependency bumps (@aws-sdk/*, toolkit, sigstore, undici, etc.), docs, and CI tooling.

That registry-auth fix does not apply to the GHCR username/password path used here. AWS SDK bumps only matter for ECR login, which is unused.

3) Risks / unknowns

• Low residual risk from transitive runtime deps (undici/toolkit/aws-sdk), but not on the exercised auth path.
• Compatibility is CI-only; validate on the next deploy-review run that GHCR login + push succeed.

4) Recommendation

Merge. Minor/patch-range update, stable public inputs, and no overlap with this repo’s usage surface.

---

Malware Scan Summary

• Status: warn
• Warn only mode: true
• Changed upstream files scanned: 18
• Resolution strategy: tag_range
• Changed node/vendor paths: 0
• Changed lockfiles: 1
• Resolved upstream range: 650006c6eb7dba73a995cc03b0b2d7f5ca915bee..af1e73f918a031802d376d3c8bbc3fe56130a9b0
• Resolved refs: from=650006c6eb7dba73a995cc03b0b2d7f5ca915bee to=af1e73f918a031802d376d3c8bbc3fe56130a9b0
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 167

Top findings

• dist/index.cjs:2 codepoint_decoder :: ,p.message,p.stack);var m=new Error("tunneling socket could not be established, cause="+p.message);m.code="ECONNRESET",e.request.emit("error",m),n.removeSocket(s)}i(d,"onError")},"createSocket");ul.prototype.removeSocket=i(function(e){var r=this.sockets.indexOf(e);if(r!==-1){this.sockets.splice(r,1);var n=this.requests.shift();n&&this.createSocket(n,function(s){n.request.onSocket(s)})}},"removeSocket");function nK(t,e){var r=this;ul.prototype.createSocket.call(r,t,function(n){var s=t.request.ge...[truncated]
• dist/index.cjs:3 codepoint_decoder :: )||t.includes("\r")||t.includes("\0"))===!1}i(zX,"isValidHeaderValue");function $$e(t,e){let{headersList:r}=e,n=(r.get("referrer-policy",!0)??"").split(","),s="";if(n.length>0)for(let o=n.length;o!==0;o--){let a=n[o-1].trim();if(N$e.has(a)){s=a;break}}s!==""&&(t.referrerPolicy=s)}i($$e,"setRequestReferrerPolicyOnRedirect");function z$e(){return"allowed"}i(z$e,"crossOriginResourcePolicyCheck");function V$e(){return"success"}i(V$e,"corsCheck");function W$e(){return"success"}i(W$e,"TAOCheck");func...[truncated]
• dist/index.cjs:4 codepoint_decoder :: );function Gze(t){for(let e=0;e<t.length;++e)if((t.charCodeAt(e)&-128)!==0)return!1;return!0}i(Gze,"isAsciiString");function Hze(t){let e=t.length;if(e<27||e>70)return!1;for(let r=0;r<e;++r){let n=t.charCodeAt(r);if(!(n>=48&&n<=57||n>=65&&n<=90||n>=97&&n<=122||n===39||n===45||n===95))return!1}return!0}i(Hze,"validateBoundary");function $ze(t,e){ib(e!=="failure"&&e.essence==="multipart/form-data");let r=e.parameters.get("boundary");if(r===void 0)return"failure";let n=Buffer.from(--${r},"utf8")...[truncated]
• dist/index.cjs:45 codepoint_decoder :: .trim())}};xte.exports=K1});var Hb=I((Czt,Tte)=>{"use strict";var Bte=Symbol.for("undici.globalDispatcher.1"),{InvalidArgumentError:RYe}=rt(),NYe=aA();Nte()===void 0&&Rte(new NYe);function Rte(t){if(!t||typeof t.dispatch!="function")throw new RYe("Argument agent must implement Agent");Object.defineProperty(globalThis,Bte,{value:t,writable:!0,enumerable:!1,configurable:!1})}i(Rte,"setGlobalDispatcher");function Nte(){return globalThis[Bte]}i(Nte,"getGlobalDispatcher");Tte.exports={setGlobalDispa...[truncated]
• dist/index.cjs:46 codepoint_decoder :: ${o};break;case"retry":yse(o)&&(r[s]=o);break;case"id":Ese(o)&&(r[s]=o);break;case"event":o.length>0&&(r[s]=o);break}}processEvent(e){e.retry&&yse(e.retry)&&(this.state.reconnectionTime=parseInt(e.retry,10)),e.id&&Ese(e.id)&&(this.state.lastEventId=e.id),e.data!==void 0&&this.push({type:e.event||"message",options:{data:e.data,lastEventId:this.state.lastEventId,origin:this.state.origin}})}clearEvent(){this.event={data:void 0,event:void 0,id:void 0,retry:void 0}}};Cse.exports={EventSourceStream:q...[truncated]
• dist/index.cjs:47 codepoint_decoder :: %s,N,N,w,n);var P=w.type==="*"?U2:w.type==="?"?F2:"\\"+w.type;s=!0,n=n.slice(0,w.reStart)+P+"\\("+N}A(),o&&(n+="\\\\");var _=!1;switch(n.charAt(0)){case"[":case".":case"(":_=!0}for(var re=c.length-1;re>-1;re--){var ye=c[re],ae=n.slice(0,ye.reStart),qe=n.slice(ye.reStart,ye.reEnd-8),ne=n.slice(ye.reEnd-8,ye.reEnd),K=n.slice(ye.reEnd);ne+=K;var U=ae.split("(").length-1,wt=K;for(h=0;h<U;h++)wt=wt.replace(/\)[+*?]?/,"");K=wt;var X="";K===""&&e!==rB&&(X="$");var lt=ae+qe+K+X+ne;n=lt}if(n!==""&&s&...[truncated]
• dist/index.cjs:64 codepoint_decoder :: Polling status: ${Bfe.includes(d)?"Stopped":"Running"}),d==="succeeded"){let p=a(u,r);if(p!==void 0)return{response:await e(p).catch(xfe({state:r,stateProxy:n,isOperationError:c})),status:d}}return{response:u,status:d}}i(_lt,"pollOperationHelper");async function vfe(t){let{poll:e,state:r,stateProxy:n,options:s,getOperationStatus:o,getResourceLocation:a,getOperationLocation:c,isOperationError:l,withOperationLocation:u,getPollingInterval:d,processResult:p,getError:m,updateState:f,setDelay:A,isDo...[truncated]
• dist/index.cjs:74 codepoint_decoder :: +this.showPosition(),{text:"",token:null,line:this.yylineno})},"next"),lex:i(function(){var o=this.next();return typeof o<"u"?o:this.lex()},"lex"),begin:i(function(o){this.conditionStack.push(o)},"begin"),popState:i(function(){return this.conditionStack.pop()},"popState"),_currentRules:i(function(){return this.conditions[this.conditionStack[this.conditionStack.length-1]].rules},"_currentRules"),topState:i(function(){return this.conditionStack[this.conditionStack.length-2]},"topState"),pushState...[truncated]
• dist/index.cjs:99 codepoint_decoder :: +c}catch{!n.logger||n.logger?.constructor?.name==="NoOpLogger"?console.warn(c):n.logger?.warn?.(c)}typeof a.$responseBodyText<"u"&&a.$response&&(a.$response.body=a.$responseBodyText);try{if(pn.isInstance(o)){let{headers:l={}}=o,u=Object.entries(l);a.$metadata={httpStatusCode:o.statusCode,requestId:tJ(/^x-[\w-]+-request-?id$/,u),extendedRequestId:tJ(/^x-[\w-]+-id-2$/,u),cfId:tJ(/^x-[\w-]+-cf-id$/,u)}}}catch{}}throw a}},"deserializerMiddleware"),tJ=i((t,e)=>(e.find(([r])=>r.match(t))||[void 0,v...[truncated]
• dist/index.cjs:110 codepoint_decoder :: If you are using React Native, this API is not yet supported, see: https://react-native.canny.io/feature-requests/p/fetch-streaming-body);return s.stream()},"blobToWebStream");return Object.assign(t,{transformToByteArray:r,transformToString:i(async s=>{let o=await r();if(s==="base64")return bQ(o);if(s==="hex")return ui(o);if(s===void 0||s==="utf8"||s==="utf-8")return sBe(o);if(typeof TextDecoder=="function")return new TextDecoder(s).decode(o);throw new Error("TextDecoder is not available, pleas...[truncated]
• dist/index.cjs:130 codepoint_decoder :: ))throw new cf("Authorization token contains invalid \\r\\n sequence.");return t},"validateToken");WTe.fromHttp=Qbt});function _bt(t){return{schemeId:"aws.auth#sigv4",signingProperties:{name:"sso-oauth",region:t.region},propertiesExtractor:i((e,r)=>({signingProperties:{config:e,context:r}}),"propertiesExtractor")}}function Dbt(t){return{schemeId:"smithy.api#noAuth"}}var YTe,JTe,jTe,gj=g(()=>{kn();we();YTe=i(async(t,e,r)=>({operation:Bt(e).operation,region:await ht(t.region)()||(()=>{throw new E...[truncated]
• dist/index.cjs:163 codepoint_decoder :: ||t==="\r"}i(epe,"isWhiteSpace");function tpe(t,e){let r=e;for(;e<t.length;e++)if(t[e]=="?"||t[e]==" "){let n=t.substr(r,e-r);if(e>5&&n==="xml")return gr("InvalidXml","XML declaration allowed only at the start of the document.",Kn(t,e));if(t[e]=="?"&&t[e+1]==">"){e++;break}else continue}return e}i(tpe,"readPI");function rpe(t,e){if(t.length>e+5&&t[e+1]==="-"&&t[e+2]==="-"){for(e+=3;e<t.length;e++)if(t[e]==="-"&&t[e+1]==="-"&&t[e+2]===">"){e+=2;break}}else if(t.length>e+8&&t[e+1]==="D"&&t[e+2]==...[truncated]
• dist/index.cjs:164 codepoint_decoder :: );let e=new bs("!xml"),r=e,n="";this.matcher.reset(),this.entityDecoder.reset(),this.entityExpansionCount=0,this.currentExpandedLength=0;let s=this.options,o=new FC(s.processEntities),a=t.length;for(let c=0;c<a;c++)if(t[c]==="<"){let u=t.charCodeAt(c+1);if(u===47){let d=ih(t,">",c,"Closing Tag is not closed."),p=t.substring(c+2,d).trim();if(s.removeNSPrefix){let f=p.indexOf(":");f!==-1&&(p=p.substr(f+1))}p=QG(s.transformTagName,p,"",s).tagName,r&&(n=this.saveTextToParentTag(n,r,this.readonlyMat...[truncated]
• dist/index.cjs:167 codepoint_decoder :: ):(this.indentate=function(){return""},this.tagEndChar=">",this.newLine="")}i(Rs,"Builder");function Dit(t,e){let r=t["?xml"];if(r&&typeof r=="object"){if(e.attributesGroupName&&r[e.attributesGroupName]){let s=r[e.attributesGroupName][e.attributeNamePrefix+"version"];if(s)return s}let n=r[e.attributeNamePrefix+"version"];if(n)return n}return"1.0"}i(Dit,"detectXmlVersionFromObj");function qG(t,e,r,n,s){return!r.sanitizeName||am(t,{xmlVersion:s})?t:r.sanitizeName(t,{isAttribute:e,matcher:n.readOn...[truncated]
• dist/index.cjs:187 codepoint_decoder :: ));let n=yield XV(r,"create");yield ZV(n,t)})}i(t4,"createTar");var Mh=function(t,e,r,n){function s(o){return o instanceof r?o:new r(function(a){a(o)})}return i(s,"adopt"),new(r||(r=Promise))(function(o,a){function c(d){try{u(n.next(d))}catch(p){a(p)}}i(c,"fulfilled");function l(d){try{u(n.throw(d))}catch(p){a(p)}}i(l,"rejected");function u(d){d.done?o(d.value):s(d.value).then(c,l)}i(u,"step"),u((n=n.apply(t,e||[])).next())})},zi=class t extends Error{static{i(this,"ValidationError")}constructo...[truncated]
• dist/index.cjs:193 codepoint_decoder :: ${t.mark.snippet}),${t.reason} ${r}):t.reason}i(xhe,"formatError");var VT=class extends Error{static{i(this,"YAMLException")}reason;mark;constructor(t,e){super(),this.name="YAMLException",this.reason=t,this.mark=e,this.message=xhe(this,!1),Error.captureStackTrace&&Error.captureStackTrace(this,this.constructor)}toString(t){return${this.name}: ${xhe(this,t)}}};function ZT(t,e,r,n=""){let s=0,o=0;for(let c=0;c<e;c++){let l=t.charCodeAt(c);l===10?(s++,o=c+1):l===13&&(s++,t.charCodeAt(c+1)===10&...[truncated]
• dist/index.cjs:194 codepoint_decoder :: `;case 118:return"\v";case 102:return"\f";case 114:return"\r";case 101:return"\x1B";case 32:return" ";case 34:return'"';case 47:return"/";case 92:return"\";case 78:return"\x85";case 95:return"\xA0";case 76:return"\u2028";case 80:return"\u2029";default:return""}}i(bhe,"simpleEscapeSequence");var khe=new Array(256),Lhe=new Array(256);for(let t=0;t<256;t++)khe[t]=bhe(t)?1:0,Lhe[t]=bhe(t);function zmt(t){